Storybook Dev Server is Vulnerable to WebSocket Hijacking

Description

The WebSocket functionality in Storybook’s dev server, used to create and update stories, is vulnerable to WebSocket hijacking. This vulnerability only affects the Storybook dev server; production builds are not impacted.

Recommendation

Update the storybook package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 10.0.0-beta.0, < 10.2.10

  >= 8.7.0-alpha.0, < 9.1.19

  >= 8.1.0, < 8.6.17**

• Patched version(s): **10.2.10

  9.1.19

  8.6.17**

References

• GHSA-mjf5-7g4m-gx5w
• CVE-2026-27148
• CWE-1385
• CWE-74
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket - CVE-2026-39363
• Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability - CVE-2026-44211
• webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins - CVE-2026-6402
• Parse Server vulnerable to schema poisoning via prototype pollution in deep copy - CVE-2026-32878

You might also like:

Exploiting Server Version Disclosure

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

storybook